In total, 2 616 adversarial signals are generated using both Fast Gradient Sign Method (FGSM) [1]} and Basic Iterative Method (BIM) [2]} by constraining the optimization program given in Eq. REF  with the maximum and minimum values of normalized inputs obtained from Eq. REF . This ensures that the adversarial signals are physically plausible, i.e., no negative traffic flows should occur. The adversarial signals generated on the substitute model are fed into the target model to obtain the “post-attack predictions” as the attack results. To measure the attack effectiveness, the inputs that are used to generate these adversarial signals are also fed into the target model to obtain “pre-attack predictions.” Root mean squared error (RMSE) is used as an evaluation metric to measure the model performance:
\(\textrm {RMSE} = \sqrt{\frac{1}{S\times F \times N} {\sum _{{i}}^S} {\sum _{{d}}^F}{\sum _{{n}}^N}{(y^i_{dn} - \hat{y}^i_{dn})}^2},\) 
